@xemahq/xema 0.59.1 → 0.60.1

package/edition/produce-distribution-completeness-evidence.mjs

@@ -1,318 +0,0 @@
-#!/usr/bin/env node
-// The distribution completeness statement and the evidence set it seals.
-//
-//   xema edition evidence statement completeness stage …   (the bytes to sign)
-//   xema edition evidence assemble-set …                    (evidence-set.json)
-//
-// `stage` resolves the edition's producer evidence into a NEW staging
-// directory, writes the canonical completeness statement there and prints the
-// signing plan. The caller signs it (`cosign attest-blob`). `assemble-set`
-// re-derives everything from the same flags, refuses staged bytes that differ,
-// verifies the signed bundle with cosign against the declared signer, writes
-// `evidence-set.json` and seals the evidence root (built from the re-derived
-// files, never renamed from the staging).
-// This module never signs and never requests an OIDC token.
-
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { dirname, isAbsolute, join, resolve } from 'node:path';
-
-import {
-  acceptSignedEvidenceStatement,
-  assertPinnedCosignVersion,
-  buildDistributionImageEvidenceSet,
-  buildDistributionImagesStatement,
-  evidenceChannelOfSigner,
-  loadPinnedTrustPolicy,
-  parseEvidenceCliFlags,
-  resolveProducerEvidence,
-  stageEvidenceStatement,
-  stageProducerEvidence,
-  stagedProducerFiles,
-} from './distribution-evidence-set.mjs';
-import {
-  WorkspaceRoot,
-  configureEditionWorkspaceFromArgv,
-  dataRoot,
-  editionsRoot,
-  isEntryModule,
-} from './edition-workspace.mjs';
-import { canonicalJsonBytes } from './image-evidence.mjs';
-import { oidcCertificateSignerKind } from './kernel-signer-kind.mjs';
-import { serializeJson } from './lib.mjs';
-import {
-  assertGitHubProducerContext,
-  createCosignVerifier,
-  loadProducerKernelSchemas,
-} from './produce-image-source-evidence.mjs';
-import { assertStagedExactly, discardStaging, reserveSealing, sealAccepted } from './sealed-evidence-accept.mjs';
-
-const EVIDENCE_SET_FILE = 'evidence-set.json';
-const COMPLETENESS_STATEMENT_PATH = 'completeness/statement.json';
-const COMPLETENESS_BUNDLE_PATH = 'completeness/bundle.sigstore.json';
-
-/** The keyless signer a GitHub workflow is: its certificate identity and issuer. */
-export function githubWorkflowSigner({ repository, ref, path }) {
-  return {
-    kind: oidcCertificateSignerKind(),
-    certificateIdentity: `https://github.com/${repository}/${path}@${ref}`,
-    oidcIssuer: 'https://token.actions.githubusercontent.com',
-    githubWorkflow: { repository, ref, path },
-  };
-}
-
-/** The producer evidence and the completeness statement these inputs resolve to; deterministic. */
-async function deriveCompleteness(options, { outputRoot }) {
-  // The channel the signer signs for is the channel the lock is read on.
-  const channel = evidenceChannelOfSigner(options.signer, options.schemas);
-  const resolution = {
-    distributionId: options.distributionId,
-    dataRoot: options.dataRoot,
-    editionsRoot: options.editionsRoot,
-    schemas: options.schemas,
-    expectedContractAuthority: options.expectedContractAuthority,
-    registryClientFactory: options.registryClientFactory,
-    channel,
-  };
-  const staged = outputRoot === null
-    ? await resolveProducerEvidence(resolution)
-    : await stageProducerEvidence({ ...resolution, outputRoot });
-  const completenessStatement = buildDistributionImagesStatement({
-    distributionLock: staged.distributionLock,
-    imageLock: staged.imageLock,
-    images: staged.images,
-    channel,
-    releaseSequence: options.releaseSequence,
-    releaseSourceCommit: options.releaseSourceCommit,
-    runId: options.runId,
-    runAttempt: options.runAttempt,
-    issuedAt: options.issuedAt,
-    expiresAt: options.expiresAt,
-    maxTtlSeconds: options.policy.maxCompletenessTtlSeconds,
-    schemas: options.schemas,
-  });
-  return { staged, completenessStatement };
-}
-
-function signingArguments(options, statement) {
-  return {
-    statement,
-    root: options.stagingDirectory,
-    statementPath: COMPLETENESS_STATEMENT_PATH,
-    bundlePath: COMPLETENESS_BUNDLE_PATH,
-    signer: options.signer,
-    certificateWorkflowSha: options.releaseSourceCommit,
-    predicateType: options.schemas.DISTRIBUTION_IMAGES_PREDICATE_TYPE,
-  };
-}
-
-/**
- * Stage the producer evidence of one edition and its completeness statement
- * for signing. Returns the signing plan and the statement.
- */
-export async function stageDistributionCompletenessEvidence(options) {
-  const { stagingDirectory } = options;
-  if (typeof stagingDirectory !== 'string' || !isAbsolute(stagingDirectory)) {
-    throw new Error('the staging directory must be an absolute path');
-  }
-  if (existsSync(stagingDirectory)) {
-    throw new Error(`evidence staging directory already exists: ${stagingDirectory}`);
-  }
-  assertGitHubProducerContext(
-    { signer: options.signer, producerWorkflowSha: options.releaseSourceCommit },
-    options.githubContext,
-  );
-  mkdirSync(stagingDirectory, { recursive: true, mode: 0o700 });
-  try {
-    const { completenessStatement } = await deriveCompleteness(options, { outputRoot: options.stagingDirectory });
-    const plan = stageEvidenceStatement(signingArguments(options, completenessStatement));
-    return {
-      plan: { ...plan, kind: 'completeness', distributionId: options.distributionId },
-      completenessStatement,
-    };
-  } catch (error) {
-    rmSync(stagingDirectory, { recursive: true, force: true });
-    throw error;
-  }
-}
-
-/**
- * Accept the signed completeness bundle of a staged directory, write
- * `evidence-set.json` and seal `evidenceRoot`.
- *
- * `evidenceRoot` is BUILT, never renamed from the staging: the producer
- * evidence is re-resolved from the registry and must be byte-identical to what
- * was staged, the completeness statement is re-derived and the signed bundle
- * canonicalized and verified, and only those derived files are written. The
- * staging must hold exactly what stage recorded and does not outlive the
- * accept (see `sealed-evidence-accept.mjs`).
- */
-export async function assembleDistributionEvidenceSet(options) {
-  const { evidenceRoot, stagingDirectory, readCosignVersion, runCosign } = options;
-  if (
-    typeof evidenceRoot !== 'string' ||
-    !isAbsolute(evidenceRoot) ||
-    typeof stagingDirectory !== 'string' ||
-    !isAbsolute(stagingDirectory)
-  ) {
-    throw new Error('the evidence root and the staging directory must be absolute paths');
-  }
-  if (typeof readCosignVersion !== 'function' || typeof runCosign !== 'function') {
-    throw new Error('cosign seams are required');
-  }
-  const sealing = reserveSealing(evidenceRoot, 'evidence');
-  let derived;
-  try {
-    assertGitHubProducerContext(
-      { signer: options.signer, producerWorkflowSha: options.releaseSourceCommit },
-      options.githubContext,
-    );
-    assertPinnedCosignVersion(readCosignVersion(), options.policy?.cosignVersion);
-    derived = await deriveCompleteness(options, { outputRoot: null });
-  } catch (error) {
-    discardStaging(stagingDirectory);
-    throw error;
-  }
-  const { staged, completenessStatement } = derived;
-  return sealAccepted({
-    stagingDirectory,
-    sealing,
-    outputDirectory: evidenceRoot,
-    build: () => {
-      assertStagedExactly(stagingDirectory, [
-        ...staged.producers.flatMap((producer) => stagedProducerFiles(producer).map(([path]) => path)),
-        COMPLETENESS_STATEMENT_PATH,
-        COMPLETENESS_BUNDLE_PATH,
-      ]);
-      for (const producer of staged.producers) {
-        for (const [path, bytes] of stagedProducerFiles(producer)) {
-          if (!readFileSync(join(stagingDirectory, path)).equals(bytes)) {
-            throw new Error(`staged ${path} is not the producer evidence this edition resolves to`);
-          }
-          mkdirSync(dirname(join(sealing, path)), { recursive: true, mode: 0o755 });
-          writeFileSync(join(sealing, path), bytes, { flag: 'wx', mode: 0o644 });
-        }
-      }
-      const completeness = acceptSignedEvidenceStatement({
-        ...signingArguments(options, completenessStatement),
-        sealingRoot: sealing,
-        runCosign,
-      });
-      const evidenceSet = buildDistributionImageEvidenceSet({
-        distributionId: options.distributionId,
-        producerEvidence: staged.producerEvidence,
-        completeness,
-        schemas: options.schemas,
-      });
-      writeFileSync(join(sealing, EVIDENCE_SET_FILE), canonicalJsonBytes(evidenceSet), {
-        flag: 'wx',
-        mode: 0o644,
-      });
-      return {
-        evidenceRoot,
-        evidenceSet,
-        completeness,
-        completenessStatement,
-        completenessStatementDigest: completeness.statementDigest,
-      };
-    },
-  });
-}
-
-function requireInteger(raw, label, { positive }) {
-  const value = Number(raw);
-  if (!/^\d+$/.test(String(raw)) || !Number.isSafeInteger(value) || (positive && value <= 0)) {
-    throw new Error(`--${label} must be a ${positive ? 'positive' : 'non-negative'} integer`);
-  }
-  return value;
-}
-
-const SHARED_FLAGS = Object.freeze([
-  'distribution',
-  'staging',
-  'release-sequence',
-  'release-source-commit',
-  'run-id',
-  'run-attempt',
-  'issued-at',
-  'expires-at',
-  'signer-repository',
-  'signer-ref',
-  'signer-workflow-path',
-  'github-repository',
-  'github-ref',
-  'github-sha',
-  'github-workflow-ref',
-]);
-
-async function main() {
-  const [phase, ...args] = configureEditionWorkspaceFromArgv(process.argv.slice(2), [
-    WorkspaceRoot.Data,
-    WorkspaceRoot.Editions,
-    WorkspaceRoot.Kernel,
-  ]);
-  if (phase !== 'stage' && phase !== 'accept') {
-    throw new Error(
-      'usage: xema edition evidence statement completeness stage … | xema edition evidence assemble-set …',
-    );
-  }
-  const flags = parseEvidenceCliFlags(args, {
-    single: phase === 'stage' ? SHARED_FLAGS : [...SHARED_FLAGS, 'evidence-root', 'cosign'],
-  });
-  const { schemas, contractAuthority } = await loadProducerKernelSchemas({ dataRoot: dataRoot() });
-  const options = {
-    distributionId: flags.require('distribution'),
-    dataRoot: dataRoot(),
-    editionsRoot: editionsRoot(),
-    stagingDirectory: resolve(flags.require('staging')),
-    schemas,
-    expectedContractAuthority: contractAuthority,
-    policy: loadPinnedTrustPolicy({ dataRoot: dataRoot(), schemas }),
-    signer: githubWorkflowSigner({
-      repository: flags.require('signer-repository'),
-      ref: flags.require('signer-ref'),
-      path: flags.require('signer-workflow-path'),
-    }),
-    githubContext: {
-      repository: flags.require('github-repository'),
-      ref: flags.require('github-ref'),
-      sha: flags.require('github-sha'),
-      workflowRef: flags.require('github-workflow-ref'),
-    },
-    releaseSequence: requireInteger(flags.require('release-sequence'), 'release-sequence', {
-      positive: false,
-    }),
-    releaseSourceCommit: flags.require('release-source-commit'),
-    runId: flags.require('run-id'),
-    runAttempt: requireInteger(flags.require('run-attempt'), 'run-attempt', { positive: false }),
-    issuedAt: flags.require('issued-at'),
-    expiresAt: flags.require('expires-at'),
-  };
-  if (phase === 'stage') {
-    const { plan } = await stageDistributionCompletenessEvidence(options);
-    process.stdout.write(serializeJson(plan));
-    return;
-  }
-  const result = await assembleDistributionEvidenceSet({
-    ...options,
-    evidenceRoot: resolve(flags.require('evidence-root')),
-    ...createCosignVerifier(resolve(flags.require('cosign'))),
-  });
-  process.stdout.write(
-    serializeJson({
-      schemaVersion: 1,
-      kind: 'evidence-set',
-      distributionId: options.distributionId,
-      evidenceRoot: result.evidenceRoot,
-      evidenceSetPath: EVIDENCE_SET_FILE,
-      producerBundles: result.evidenceSet.producerEvidence.length,
-      completenessStatementDigest: result.completenessStatementDigest,
-    }),
-  );
-}
-
-if (isEntryModule(import.meta.url)) {
-  main().catch((error) => {
-    console.error(`[distribution-completeness-evidence] ${error.message}`);
-    process.exitCode = 1;
-  });
-}

package/edition/produce-edition-catalogue-evidence.mjs

@@ -1,252 +0,0 @@
-#!/usr/bin/env node
-// The edition catalogue statement (E4): "this offering artifact's catalogue layer and lock layer are these digests, on this
-// channel", signed by the vendor's release workflow and attached to the artifact as an `oras attach` referrer.
-//
-//   xema edition evidence statement catalogue stage|accept …
-//
-// `stage` reads the artifact manifest by digest, derives the statement from its catalogue layer and lock layer and writes
-// the canonical statement into a NEW staging directory, printing the signing plan; the caller signs it (`cosign
-// attest-blob`); `accept` re-derives the statement from the same flags, refuses staged bytes that differ, verifies the
-// signed bundle with cosign against the declared signer, seals the output (built from the re-derived files, never renamed
-// from the staging) and ATTACHES statement.json and bundle.sigstore.json to the artifact digest as a referrer carrying the
-// signing workflow's commit. A customer's pinned verifier reads exactly that referrer (catalogue-evidence.mjs).
-// This module never signs and never requests an OIDC token.
-
-import { existsSync, mkdirSync, rmSync } from 'node:fs';
-import { isAbsolute, resolve } from 'node:path';
-
-import {
-  CATALOGUE_EVIDENCE_BUNDLE_TITLE,
-  CATALOGUE_EVIDENCE_STATEMENT_MEDIA_TYPE,
-  CATALOGUE_EVIDENCE_STATEMENT_TITLE,
-  CATALOGUE_EVIDENCE_WORKFLOW_SHA_ANNOTATION,
-} from './catalogue-evidence.mjs';
-import { layerTitled, parseCatalogueRef } from './catalogue-fetch.mjs';
-import { CATALOGUE_FILE } from './catalogue.mjs';
-import {
-  acceptSignedEvidenceStatement,
-  assertPinnedCosignVersion,
-  evidenceChannelOfSigner,
-  loadPinnedTrustPolicy,
-  parseEvidenceCliFlags,
-  stageEvidenceStatement,
-} from './distribution-evidence-set.mjs';
-import { EDITION_ARTIFACT_TYPE, EditionLockFile } from './edition-constants.mjs';
-import { WorkspaceRoot, configureEditionWorkspaceFromArgv, dataRoot, isEntryModule } from './edition-workspace.mjs';
-import { serializeJson } from './lib.mjs';
-import { EDITION_CATALOGUE_EVIDENCE_ARTIFACT_TYPE, createRegistryClientResolver } from './oci-image-source-evidence.mjs';
-import { githubWorkflowSigner } from './produce-distribution-completeness-evidence.mjs';
-import {
-  BUNDLE_MEDIA_TYPE,
-  assertGitHubProducerContext,
-  createCosignVerifier,
-  loadProducerKernelSchemas,
-} from './produce-image-source-evidence.mjs';
-import { assertStagedExactly, discardStaging, reserveSealing, sealAccepted } from './sealed-evidence-accept.mjs';
-
-const STATEMENT_TYPE = 'https://in-toto.io/Statement/v1';
-const hexOf = (digest) => digest.slice('sha256:'.length);
-
-const SHARED_FLAGS = Object.freeze([
-  'artifact',
-  'offering',
-  'staging',
-  'signer-repository',
-  'signer-ref',
-  'signer-workflow-path',
-  'github-repository',
-  'github-ref',
-  'github-sha',
-  'github-workflow-ref',
-]);
-
-/**
- * The E4 statement of the offering artifact `artifact` (`oci://<repository>@sha256:<d>`), derived from the manifest the
- * registry serves for that digest: its catalogue layer and lock layer, exactly as a customer's `fetchCatalogue` reads them.
- * The channel is the signer's, and must be the repository's.
- */
-export async function deriveEditionCatalogueStatement({ artifact, offeringId, signer, schemas, client }) {
-  const { repository, digest, edition } = parseCatalogueRef(artifact);
-  const channel = evidenceChannelOfSigner(signer, schemas);
-  if (edition.distributionId !== offeringId) {
-    throw new Error(`--offering ${offeringId} is not the offering of ${artifact} (its repository is the offering ${edition.distributionId})`);
-  }
-  if (edition.channel !== channel) {
-    throw new Error(`${artifact} is in a ${edition.channel} repository, but the signer signs for the ${channel} channel`);
-  }
-  const manifest = await client.getManifestByDigest(repository, digest);
-  if (manifest.isIndex || manifest.document.artifactType !== EDITION_ARTIFACT_TYPE) {
-    throw new Error(`${artifact} is not an edition artifact (artifactType ${JSON.stringify(manifest.document.artifactType)}, expected ${EDITION_ARTIFACT_TYPE})`);
-  }
-  const catalogueLayer = layerTitled(manifest, CATALOGUE_FILE, artifact);
-  const lockLayer = layerTitled(manifest, EditionLockFile.Distribution, artifact);
-  const statement = {
-    _type: STATEMENT_TYPE,
-    subject: [{ name: `xema-edition-${offeringId}`, digest: { sha256: hexOf(digest) } }],
-    predicateType: schemas.EDITION_CATALOGUE_PREDICATE_TYPE,
-    predicate: {
-      schemaVersion: 1,
-      offeringId,
-      channel,
-      catalogueDigest: catalogueLayer.digest,
-      lockDigest: hexOf(lockLayer.digest),
-    },
-  };
-  schemas.parseEditionCatalogueStatement(statement);
-  return { statement, channel, repository, subjectDigest: digest };
-}
-
-function signingOf({ derived, options }) {
-  return {
-    statement: derived.statement,
-    root: options.stagingDirectory,
-    statementPath: CATALOGUE_EVIDENCE_STATEMENT_TITLE,
-    bundlePath: CATALOGUE_EVIDENCE_BUNDLE_TITLE,
-    signer: options.signer,
-    certificateWorkflowSha: options.signingWorkflowSha,
-    predicateType: options.schemas.EDITION_CATALOGUE_PREDICATE_TYPE,
-  };
-}
-
-/** Stage the catalogue statement of an artifact for signing. Returns the signing plan and the statement. */
-export async function stageEditionCatalogueEvidence(options) {
-  const { stagingDirectory } = options;
-  if (typeof stagingDirectory !== 'string' || !isAbsolute(stagingDirectory)) {
-    throw new Error('the catalogue staging directory must be absolute');
-  }
-  if (existsSync(stagingDirectory)) {
-    throw new Error(`catalogue staging directory already exists: ${stagingDirectory}`);
-  }
-  assertGitHubProducerContext({ signer: options.signer, producerWorkflowSha: options.signingWorkflowSha }, options.githubContext);
-  const derived = await deriveEditionCatalogueStatement(options);
-  mkdirSync(stagingDirectory, { recursive: true, mode: 0o700 });
-  try {
-    const plan = stageEvidenceStatement(signingOf({ derived, options }));
-    return {
-      plan: { ...plan, kind: 'edition-catalogue', offeringId: options.offeringId, channel: derived.channel, subjectDigest: derived.subjectDigest },
-      statement: derived.statement,
-    };
-  } catch (error) {
-    rmSync(stagingDirectory, { recursive: true, force: true });
-    throw error;
-  }
-}
-
-/**
- * Accept the signed catalogue bundle, seal `outputDirectory` and attach its two files to the artifact digest as an
- * `EDITION_CATALOGUE_EVIDENCE_ARTIFACT_TYPE` referrer. The output is BUILT from the re-derived statement and the
- * canonicalized bundle, never renamed from the staging, which must hold exactly what stage recorded and does not outlive
- * the accept.
- */
-export async function acceptEditionCatalogueEvidence(options) {
-  const { outputDirectory, stagingDirectory, readCosignVersion, runCosign, client } = options;
-  if (
-    typeof outputDirectory !== 'string' ||
-    !isAbsolute(outputDirectory) ||
-    typeof stagingDirectory !== 'string' ||
-    !isAbsolute(stagingDirectory)
-  ) {
-    throw new Error('the catalogue output and staging directories must be absolute');
-  }
-  if (typeof readCosignVersion !== 'function' || typeof runCosign !== 'function') {
-    throw new Error('cosign seams are required');
-  }
-  const sealing = reserveSealing(outputDirectory, 'catalogue');
-  let derived;
-  try {
-    assertGitHubProducerContext({ signer: options.signer, producerWorkflowSha: options.signingWorkflowSha }, options.githubContext);
-    assertPinnedCosignVersion(readCosignVersion(), options.policy?.cosignVersion);
-    derived = await deriveEditionCatalogueStatement(options);
-  } catch (error) {
-    discardStaging(stagingDirectory);
-    throw error;
-  }
-  const descriptor = sealAccepted({
-    stagingDirectory,
-    sealing,
-    outputDirectory,
-    build: () => {
-      assertStagedExactly(stagingDirectory, [CATALOGUE_EVIDENCE_STATEMENT_TITLE, CATALOGUE_EVIDENCE_BUNDLE_TITLE]);
-      return acceptSignedEvidenceStatement({ ...signingOf({ derived, options }), sealingRoot: sealing, runCosign });
-    },
-  });
-  const referrerDigest = await client.attach(derived.repository, derived.subjectDigest, {
-    artifactType: EDITION_CATALOGUE_EVIDENCE_ARTIFACT_TYPE,
-    files: [
-      { path: descriptor.statementPath, mediaType: CATALOGUE_EVIDENCE_STATEMENT_MEDIA_TYPE },
-      { path: descriptor.bundlePath, mediaType: BUNDLE_MEDIA_TYPE },
-    ],
-    annotations: { [CATALOGUE_EVIDENCE_WORKFLOW_SHA_ANNOTATION]: options.signingWorkflowSha },
-    cwd: outputDirectory,
-  });
-  return {
-    outputDirectory,
-    statement: derived.statement,
-    channel: derived.channel,
-    subjectDigest: derived.subjectDigest,
-    referrerDigest,
-    descriptor,
-  };
-}
-
-async function main() {
-  const [phase, ...args] = configureEditionWorkspaceFromArgv(process.argv.slice(2), [WorkspaceRoot.Data, WorkspaceRoot.Kernel]);
-  if (phase !== 'stage' && phase !== 'accept') {
-    throw new Error('usage: xema edition evidence statement catalogue <stage|accept> …');
-  }
-  const flags = parseEvidenceCliFlags(args, {
-    single: phase === 'stage' ? SHARED_FLAGS : [...SHARED_FLAGS, 'output', 'cosign'],
-    repeated: [],
-  });
-  const { schemas } = await loadProducerKernelSchemas({ dataRoot: dataRoot() });
-  const artifact = flags.require('artifact');
-  const githubSha = flags.require('github-sha');
-  const { authority } = parseCatalogueRef(artifact);
-  const options = {
-    artifact,
-    offeringId: flags.require('offering'),
-    stagingDirectory: resolve(flags.require('staging')),
-    schemas,
-    policy: loadPinnedTrustPolicy({ dataRoot: dataRoot(), schemas }),
-    client: createRegistryClientResolver({ dataRoot: dataRoot() })(authority),
-    signer: githubWorkflowSigner({
-      repository: flags.require('signer-repository'),
-      ref: flags.require('signer-ref'),
-      path: flags.require('signer-workflow-path'),
-    }),
-    githubContext: {
-      repository: flags.require('github-repository'),
-      ref: flags.require('github-ref'),
-      sha: githubSha,
-      workflowRef: flags.require('github-workflow-ref'),
-    },
-    signingWorkflowSha: githubSha,
-  };
-  if (phase === 'stage') {
-    process.stdout.write(serializeJson((await stageEditionCatalogueEvidence(options)).plan));
-    return;
-  }
-  const result = await acceptEditionCatalogueEvidence({
-    ...options,
-    outputDirectory: resolve(flags.require('output')),
-    ...createCosignVerifier(resolve(flags.require('cosign'))),
-  });
-  process.stdout.write(
-    serializeJson({
-      schemaVersion: 1,
-      kind: 'edition-catalogue',
-      offeringId: options.offeringId,
-      channel: result.channel,
-      subjectDigest: result.subjectDigest,
-      referrerDigest: result.referrerDigest,
-      evidence: result.descriptor,
-    }),
-  );
-}
-
-if (isEntryModule(import.meta.url)) {
-  main().catch((error) => {
-    console.error(`[edition-catalogue] ${error.message}`);
-    process.exitCode = 1;
-  });
-}